Informações sobre a V-SOL V2802RH XPON ONT/ONU. Teardown, hacking, unlocking (desbloqueio), firmwares, custom images, recuperação, bridge.

9601D
PRELOADER Bismarck 3.5
II: PLR:bad0c0de, Build_date:22051111, Toolkit:rsdk-4.8.5-5281-EB-2.6.30-u0.9.33-m32utb-150924
II: Disable OCP Timeout Monitor
II: Disable LX Timeout Monitor
II: Enable Triple Synchronizer
II:cg_cpu_clk_init doneII:cg_spif_clk_init doneII: CPU 300MHz (600/2/0), MEM 325MHz, LX 200MHz, SPIF 25MHz
II: NOR SPI-F... 5E4016/MMIO16-1/ModeC done
AK: DRAM AUTO CALIBRATION(20210202)
AK: ZQ Calibration PassedAK: ZQ Calibration PassedAK: ZQ Calibration PassedAK: ZQ Calibration PassedAK: MR0: 0x00100952
AK: MR1: 0x00110040
AK: MR2: 0x00120000
AK: MR3: 0x00130000
AK: clear dwdqor
AK: Bit/max_r_s/max_r_l/max_w_s/max_w_l    Bit/max_r_s/max_r_l/max_w_s/max_w_l(Hex)
   [ 0]       0      1f       0      1b   [16]       0      1f       0      1b
   [ 1]       0      1f       0      1b   [17]       0      1f       0      1b
   [ 2]       0      1f       0      1b   [18]       0      1f       0      1b
   [ 3]       0      1f       0      1b   [19]       0      1f       0      1b
   [ 4]       0      1f       0      1b   [20]       0      1f       0      1b
   [ 5]       0      1f       0      19   [21]       0      1f       0      19
   [ 6]       0      1f       0      1d   [22]       0      1f       0      1b
   [ 7]       0      1f       0      1b   [23]       0      1f       0      1b
   [ 8]       0      1f       0      1d   [24]       0      1f       0      1d
   [ 9]       0      1f       0      1f   [25]       0      1f       0      1f
   [10]       0      1f       0      1d   [26]       0      1f       0      1d
   [11]       0      1f       0      1f   [27]       0      1f       0      1f
   [12]       0      1f       0      1f   [28]       0      1f       0      1f
   [13]       0      1f       0      1d   [29]       0      1f       0      1d
   [14]       0      1f       0      1f   [30]       0      1f       0      1f
   [15]       0      1f       0      1d   [31]       0      1f       0      1d
AK: DQ enable delay sync with DQ delay tap.
    0xb80015D0=0x09090909, 0xb80015D4=0x09090809, 0xb80015D8=0x0a090a09, 0xb80015DC=0x090a090a
AK: DRAM size = 0x2000000
AK: Disable read after write function
AK: Support tREFI divided by 4
AK: dram auto calibrtaion is done
II: MEM_PROBE_OK
II: MEM_XLAT_OK
II: MEM_TO_REG_OK
II: MEM_CAL_OK
II: Change Stack from 0x9f007ff8 to 0x80efffe0
II: Decompressing U-Boot (0x80d80000 <- 0x9fc0f250)... (184 KB <- 69 KB) OK
II: Starting U-boot... 


U-Boot 2011.12.NA (May 13 2022 - 14:01:56)

Board: RTL9601D, CPU:300MHz, LX:200MHx, MEM:325MHz, Type:DDR2
DRAM: 32 MB
SPI-F: 5E4016/MMIO16-1/ModeC 1x4 MB (plr_flash_info @ 80dacb48)
Loading 8192B env. variables from offset 0x21000
Loading 8192B env. variables from offset 0x23000
Loaded 8192B env. variables from offset 0x23000
Error: Cannot find rootfs partition
Net:   LUNA GMAC 
Warning: eth device name has a space!

Hit any key to stop autoboot:  3 2 1 0 
swcore_init
LUNA GMAC 
Warning: eth device name has a space!

multicast_start Using LUNA GMAC  device
mcast upgrade timeout.
## Booting kernel from OSK Image at 9fc27000 ...
   Image Name:   router.
   Created:      Mon Jan 16 13:50:49 2023
   Image Type:   0x05
   Image Length: 0x1fceb4
   Page Size:    0x9084
   Load Address: 0x80000000
   Entry Point:  0x80c3d374
   Verifying Checksum ... OK
   Uncompressing OSK image ... OK
Starting kernel ...

create memory pool: start at 0x80c40dd8, size 3928616
spi_init(2100) c2/20
spi_init(2100) ef/30
spi_init(2100) 1/2
spi_init(2100) 1/20
spi_init(2100) 1c/31
spi_init(2100) 8c/20
spi_init(2100) 1f/46
spi_init(2100) bf/25
spi_init(2100) c8/40
spi_init(2100) ef/40
spi_init(2100) 1c/30
SPI flash: id 5e/40 not registered, using default api
8 wired tlb entry, 8 pages for pgt
 mib chain:ATM_VC_TBL descpritor's size don't match its recordSize, please check it! 
 mib chain:DHCP_NORMAL_POOL descpritor's size don't match its recordSize, please check it! 
 mib chain:DHCP_SERVING_POOL descpritor's size don't match its recordSize, please check it! 
 mib chain:USERNAME_PASSWORD descpritor's size don't match its recordSize, please check it! 
 mib chain:STATIC_IP_ROUTE descpritor's size don't match its recordSize, please check it! 
 mib chain:URL_STR descpritor's size don't match its recordSize, please check it! 
 mib chain:KEYWORD_STR descpritor's size don't match its recordSize, please check it! 
 mib chain:DOMAIN_STR descpritor's size don't match its recordSize, please check it! 
 mib chain:NATRULE_INSRC descpritor's size don't match its recordSize, please check it! 
 mib chain:NATRULE_INSRC_STATIC descpritor's size don't match its recordSize, please check it! 
 mib chain:NATRULE_INSRC_FROM descpritor's size don't match its recordSize, please check it! 
 mib chain:IP_ACL_STD_ENTRY descpritor's size don't match its recordSize, please check it! 
 mib chain:IP_ACL_EXT_ENTRY descpritor's size don't match its recordSize, please check it! 
 mib chain:QOS_RULE descpritor's size don't match its recordSize, please check it! 
 mib chain:NAT_PRIORITY_RULES descpritor's size don't match its recordSize, please check it! 
 mib chain:IPV6_STATIC_ROUTE descpritor's size don't match its recordSize, please check it! 
 mib chain:RA_ENTRY descpritor's size don't match its recordSize, please check it! 
 mib chain:RA_PREFIX descpritor's size don't match its recordSize, please check it! 
 mib chain:RA_ULA_PREFIX descpritor's size don't match its recordSize, please check it! 
 mib chain:IPV6_FILTER descpritor's size don't match its recordSize, please check it! 
 mib chain:IPV6_ACL descpritor's size don't match its recordSize, please check it! 
 mib chain:DHCPV6S_INTERFACE descpritor's size don't match its recordSize, please check it! 
 mib chain:DHCPV6C_INTERFACE descpritor's size don't match its recordSize, please check it! 
 mib chain:DHCPV6_UUID descpritor's size don't match its recordSize, please check it! 
 mib chain:CWMP_DOWNLOAD_QUEUE descpritor's size don't match its recordSize, please check it! 
retrieve_settings:994 flag 0
flash hw  config addr:0xb4025000 size:8192
uncompress: preLen:830, unPreLen:1584
retrieve_settings:994 flag 3
flash sw extra default mib config addr:0xb43ae000 size:32768
sw extra default mib setting is empty!
retrieve_settings:994 flag 2
flash sw default config addr:0xb43bb000 size:32768
sw default setting is empty!
retrieve_settings:994 flag 0
flash sw  config addr:0xb43f8000 size:32768
uncompress: preLen:7817, unPreLen:33541
system config initial finsihed.
SE:33.SE:34.SE:35.SE:36.V1.1.3,lan_type:3
rtkbosa: Version 1.0 (Jan 16 2023 - 13:49:53)
rtkbosa: Detecting RTL8290B ...
rtkbosa: Error (0x10): The chip is not found
rtkbosa: Detecting UX3320_Serise ...
rtkbosa: Detecting Semtech Series (GN2xL9x) ...
rtkbosa: Read 0x51.0x7B(0x00): 0x00
rtkbosa: Read 0x51.0x7C(0x00): 0x00
rtkbosa: Read 0x51.0x7D(0x00): 0x00
rtkbosa: Read 0x51.0x7E(0x00): 0x00
rtkbosa: Detecting Semtech Bosa ID ...
rtkbosa: A2 Table ff: 0x80 = 0x80 ; 0x85 = 0xf7 ; 0x86 = 0xfb
rtkbosa: A2 Table 2: 0xD1 = 0xa3
rtkbosa: SEMTECH GN25L95 is Found
rtkbosa: A2 Table 2: 0xC0 = 0x02
rtkbosa: none EEPROM exists.
Firmware version:V1.1.3,Build Date:Jan 16 2023 13:49:46
registerTask stackp=[0x5005d000-0x5000c000], size 331776, name=CFGTASK
registerTask stackp=[0x500b2000-0x50061000], size 331776, name=CLITASK
registerTask stackp=[0x50106000-0x500b6000], size 327680, name=GENTSK
registerTask stackp=[0x5015a000-0x5010a000], size 327680, name=XTCPIP
registerTask stackp=[0x501ae000-0x5015e000], size 327680, name=EWSTSK
registerTask stackp=[0x50201000-0x501b2000], size 323584, name=FEATTASK
registerTask stackp=[0x50253000-0x50205000], size 319488, name=PPPoE
registerTask stackp=[0x502a5000-0x50257000], size 319488, name=ppp
registerTask stackp=[0x502f7000-0x502a9000], size 319488, name=TFTP
registerTask stackp=[0x50349000-0x502fb000], size 319488, name=DNS
registerTask stackp=[0x5039c000-0x5034d000], size 323584, name=Telnet
registerTask stackp=[0x503ee000-0x503a0000], size 319488, name=DHCP
registerTask stackp=[0x50440000-0x503f2000], size 319488, name=NTP
registerTask stackp=[0x50493000-0x50444000], size 323584, name=UPNP
registerTask stackp=[0x504e7000-0x50497000], size 327680, name=CWMPSRV
registerTask stackp=[0x50546000-0x504eb000], size 372736, name=CWMPCLT
registerTask stackp=[0x5059a000-0x5054a000], size 327680, name=CWMPDL
registerTask stackp=[0x505ee000-0x5059e000], size 327680, name=CWMPDLD
registerTask stackp=[0x50641000-0x505f2000], size 323584, name=CWMPUE
registerTask stackp=[0x508f7000-0x50645000], size 2826240, name=rtl8670
registerTask stackp=[0x50949000-0x508fb000], size 319488, name=dhcpv6d
registerTask stackp=[0x5099b000-0x5094d000], size 319488, name=dhcpv6c
registerTask stackp=[0x509ed000-0x5099f000], size 319488, name=work
registerTask stackp=[0x50a42000-0x509f1000], size 331776, name=LBDTASK
registerTask stackp=[0x50aa1000-0x50a46000], size 372736, name=OMCIAPP
registerTask stackp=[0x50af5000-0x50aa5000], size 327680, name=OMCICLI
registerTask stackp=[0x50b49000-0x50af9000], size 327680, name=FIRMWARE
registerTask stackp=[0x50ba0000-0x50b4d000], size 339968, name=IDLETSK
eraseUnusedFlash erase the flash sector 0xb43a0000 remain=0xe000
SE:928.SE:929.SE:930.SE:931.SE:932.SE:933.SE:934.SE:935.SE:936.SE:937.SE:938.SE:939.SE:940.SE:941.
~~~~bufsize = 2224,datapool->start = 0x80c8bb9c,datapool->end = 0x80cd139c~~~~
Calibrating delay loop... 299.82 BogoMIPS
Init RTK Driver Module....OK
registerTask stackp=[0x50bf3000-0x50ba4000], size 323584, name=INTBCST
registerTask stackp=[0x50c46000-0x50bf7000], size 323584, name=INTBCST_1
ret=0x0 chipId = 0x96030002, rev=0x2 subType=0x6
RTL8686 GMAC Probing..
8686 Ethernet driver v0.0.1 (Feb 17, 2012)[Dual Band Disable]
TX[256,64,64,64,64] , RX[256,32,32,32,32,64]
first entry: 0, portmask 127, rx: 800076b4
mld_snp_pool_init 1128
mld_snp_pool_init 1143
wanportmask=4,lanportmask=3
RTL8686 GMAC Probing Success!!!
Init RTK liteRomeDriver....OK
Init RTK RG fwdEngine....priority: 0, portmask 127, rx: 800076b4
insert here, priority: 1, portmask 127, rx: 8031c425
OK
Init RTK RG Driver....Phy Link=0
OK

Port		ifindex range
Br		1
Wan		2-9
PPP		10-17
Switch		18-21
GIF		30-33
SE:35.SE:36.SE:33.SE:34.SE:33.SE:34.SE:35.SE:36.addV6FastpathEntryCache 717 i=64 max=64 count=64
init mac based tag des
Turn on.
===============================CAUTION===============================
This functionality should configure BEFORE romeDriver initialization.
Otherwise may cause unpredictable problem.
Init RG with GPON mode.
Phy Link=0
=============Init_rg_api SUCESS!!==================
Init_rg_api 719: do system (echo 1 > /proc/rg/proc_to_pipe
)
0
to disable stag_enable
[setLookupMissFloodPmask@748] SW_LAN_PORT_NUM 2
[setLookupMissFloodPmask@758] phyPort 1
[setLookupMissFloodPmask@758] phyPort 0
rg echo 1 igmp_general_query_fromPon_direct_txRealtek TR-142 Module initialized. err = 0, max_ponq_id=65
link up for port 3
link up for port 0
####initial default route table!
####initial cwmp route table!
####initial local route table!
####inital 4 port mapping route tables!
####inital 5 port mapping tables!
alloc 9k bytes for route table
registerPacket  hash=24
registerPacket  hash=27
registerPacket  hash=26
registerPacket  hash=6
registerPacket  hash=29
registerPacket  hash=3
registerPacket  hash=4
dnsInit:pRelayInfo=80ddad1c,pNsCCB=80ddbd38
dns wait time is 2 secs
TR111: try to clear all
dhcpv6dmain start..............................
loopback: LoopEnable = 1
loopback: LoopExistPeriod = 5
loopback: LoopCancelPeriod = 300
loopback: EthernetType = 0xFFFA
registerPacket  hash=26
registerPacket  hash=27
loopback: vid = untagged
total 1 vlan values
fffa
lbd_rg_init-236 cmd:rg echo 0xfffa keep_ps_eth
reset_loop_intf-535
veip, create proc failed!
vgf, create proc failed!
dmMode, create proc failed!
l2, create proc failed!
devmode, create proc failed!
usage, create proc failed!
wanInfo, create proc failed!
macFilter, create proc failed!
f2dq, create proc failed!
uniQos, create proc failed!
debugInfo, create proc failed!
omciMirror, create proc failed!


 @platform_db_init(9761) macBasedTagDecision=[1], ivlMacast=[0], fwdVLAN_CPU=[1], fwdVLAN_CPU_SVLAN=[2]

omci platform attached!
register_gpon_evt_state: register gpon event state Successfully !
flashfile_init(3118)>flag[1]! flashp=0xb43e7000 max_size=0x4000
load default certificate files
flashfile_init>got OSK1FS, size=8480, cksum=40177
flashfile_copy2ram>create new file(omci_mib.cfg), size=7922
flashfile_copy2ram>create new file(omci_custom_opt.conf), size=435
flashfile_copy2ram>create new file(omci_raw_data), size=0
loid pwd.....: 123456
link up for port 2
rtkbosa: Init GN25L95 ...Open file [rtl-25l95-backup.bin]
flashfile_init(3118)>flag[2]! flashp=0xb43e3000 max_size=0x4000
load default certificate files
flashfile_init>got OSK1FS, size=1056, cksum=59155
flashfile_copy2ram>create new file(rtl-25l95-backup.bin), size=1024
{Vs_lan_sds_monitor_thread:411}
rtkbosa: (0) Dump A0
rtkbosa: 1b) Dump LUTs4 Data
rtkbosa: 2b) Dump LUTs5 Data
rtkbosa: 3b) Dump LUTs6 Data
rtkbosa: 4b) Dump A2.table2
rtkbosa: (5) Dump all slope and offsets - A2_TABLE2
rtkbosa: (6) Dump all alarms and warnings levels A2-Lower
rtkbosa: (7) Set PON_CONTROL
rtkbosa:   Read  PON_CONTROL reg (A2T2.182): 04
rtkbosa:   Write PON_CONTROL reg (A2T2.182): 04
rtkbosa: 7a) Dump A2.lower
rtkbosa: (8) Enable all alarms and warnings
rtkbosa:   Read  reg (A2T1.249): 00
rtkbosa:   Write reg (A2T1.249): c0
rtkbosa:   Read  reg (A2T1.253): 00
rtkbosa:   Write reg (A2T1.253): c0
rtkbosa: (9) Soft TX disable reset
rtkbosa: Step 9) Soft TX reg (0): 80
rtkbosa: Set Soft TX reg (1): c0
rtkbosa: Set Soft TX reg (2): 80
rtkbosa: (10) Set Safe Mode Start Up
rtkbosa: (11) Set up the password level
rtkbosa: Init done ...
init_rtsp_ssrc 39
nat entry's size is 148 bytes
Nat Entry Maxinum:	4096	
gNatCachePoolp=0x80b256c4 gNatCachePoolp->qcnt=512
priority rule total 0 !
priority rule total 0 !
handleIGMPandMLD: isIGMPenable:1, isMLDenable:1
Both IGMP and MLD.
Both IGMP and MLD snooping are enabled!
setIpRouteStaticDetail iproute->itf=1 gateway=0x00000000

cmd=config

cmd=ip access-list extended lan2local 

cmd=permit mark 242
acl_id = 4
	listid = 4
	PERMIT prot:ip s=0/0 d=0/0
acl_id = 3
acl_id = 2
acl_id = 1

cmd=permit  udp any any  eq 53 local enable

cmd=permit  udp any any  eq 1900 local enable

cmd=permit  tcp any any  eq 5431 local enable
localServer[1].protocolName=tcp,localServer[1].port=80

cmd=deny  tcp any any  eq 80 local enable
localServer[2].protocolName=tcp,localServer[2].port=23

cmd=deny  tcp any any  eq 23 local enable
localServer[3].protocolName=tcp,localServer[3].port=22

cmd=deny  tcp any any  eq 22 local enable
localServer[4].protocolName=udp,localServer[4].port=69

cmd=deny  udp any any  eq 69 local enable
localServer[5].protocolName=udp,localServer[5].port=161

cmd=deny  udp any any  eq 161 local enable
localServer[6].protocolName=icmp,localServer[6].port=0

cmd=deny  icmp any any  local enable
localServer[7].protocolName=tcp,localServer[7].port=21

cmd=deny  tcp any any  eq 21 local enable
localServer[8].protocolName=udp,localServer[8].port=520

cmd=deny  udp any any  eq 520 local enable

cmd=exit

cmd=exit

cmd=config

cmd= ip  mark interface any  tcp src 0.0.0.0 0.0.0.0 0 dst 0.0.0.0 0.0.0.0 7547 241 cwmp wan

cmd=ip access-list extended wan2local 

cmd=permit mark 241
acl_id = 4
	listid = 4
	PERMIT prot:ip s=0/0 d=0/0
	listid = 4
	PERMIT prot:udp  sport=0-0 eq dport=53-53 s=0/0 d=0/0
	listid = 4
	PERMIT prot:udp  sport=0-0 eq dport=1900-1900 s=0/0 d=0/0
	listid = 4
	PERMIT prot:tcp(0)  sport=0-0 eq dport=5431-5431 s=0/0 d=0/0
	listid = 4
	DENY prot:tcp(0)  sport=0-0 eq dport=80-80 s=0/0 d=0/0
	listid = 4
	DENY prot:tcp(0)  sport=0-0 eq dport=23-23 s=0/0 d=0/0
	listid = 4
	DENY prot:tcp(0)  sport=0-0 eq dport=22-22 s=0/0 d=0/0
	listid = 4
	DENY prot:udp  sport=0-0 eq dport=69-69 s=0/0 d=0/0
	listid = 4
	DENY prot:udp  sport=0-0 eq dport=161-161 s=0/0 d=0/0
	listid = 4
	DENY prot:icmp type(255) code(255) s=0/0 d=0/0
	listid = 4
	DENY prot:tcp(0)  sport=0-0 eq dport=21-21 s=0/0 d=0/0
	listid = 4
	DENY prot:udp  sport=0-0 eq dport=520-520 s=0/0 d=0/0
acl_id = 3
acl_id = 2
	listid = 2
	PERMIT prot:ip s=0/0 d=0/0
acl_id = 1

cmd=exit

cmd=exit

cmd=cfg set WAN_ACL_DEFAULT_ACTION  1
flash read - access list not created 
flash read - access list not created 
flash read - access list not created 
flash read - access list not created 
flash read - access list not created 
flash read - access list not created 
flash read - access list not created 
flash read - access list not created 
flash read - access list not created 
flash read - access list not created 
flash read - access list not created 
flash read - access list not created 
flash read - access list not created 
cfgSetIgmpProxyAnyItf  isDisable=1
*******ipv6Init() Start*******
*****Ipv6 Lib Version Is 8.0.0*****
ipfw2 (+ipv6) initialized, divert loadable, nat loadable, rule-based forwarding disabled, default to accept, logging 
####ipfw2 dynamic entry size: 92 bytes,pre malloc 64 entries
disabled
Enter SetupFWRule!
do_firewall_cmd:command=flush 
Flushed all rules.
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add check-state  
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add skipto 1000 icmp6 from any to any icmp6types 128,129 
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add allow icmp6 from any to me6 
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add 1000 skipto 5000 ip6 from any to me6 in via e1 
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add skipto 5000 ip6 from me6 to any out via e1 
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add skipto 10000 ip6 from any to me6 in via wan 
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add skipto 10000 ip6 from me6 to any out via wan 
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add skipto 15000 ip6 from any to any 
do_firewall_cmd() execute successfully!
Enter SetupLanAclRule!
do_firewall_cmd:command=set 1 flush  
Flushed all rules.
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add 9980 set 1 allow ip6 from any to any out keep-state 
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add 9990 set 1 allow ip6 from any to any in keep-state 
do_firewall_cmd() execute successfully!
Enter SetupWanAclRule!
do_firewall_cmd:command=set 2 flush  
Flushed all rules.
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add 10010 set 2 allow icmp6 from any to any in keep-state icmp6types 128,129
do_firewall_cmd:command=add 14980 set 2 allow ip6 from any to any out keep-state 
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add 14990 set 2 deny ip6 from any to any in 
do_firewall_cmd() execute successfully!
Enter SetupWanAclRule!
do_firewall_cmd:command=set 3 flush  
Flushed all rules.
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add 19980 set 3 allow ip6 from any to any out recv e1 xmit wan keep-state 
do_firewall_cmd() execute successfully!
do_firewall_cmd:command=add 19990 set 3 allow ip6 from any to any out recv wan xmit e1 keep-state 
do_firewall_cmd() execute successfully!
Restart IPv6 Filter!
*******ipv6Init() End*******
registerPacket  hash=3
getCommonDivisorfromArray 1091 len=4 (40 30 20 10)
getCommonDivisorfromArray 1102 g=10
wfqScale[0]=4
wfqScale[1]=3
wfqScale[2]=2
wfqScale[3]=1
Reset RG QoS total bandwidth to unlimit.
handleIGMPandMLD: isIGMPenable:1, isMLDenable:1
Both IGMP and MLD.
Both IGMP and MLD snooping are enabled!
registerPacket  hash=1
captive portal redirect url string:
registerPacket  hash=18
registerPacket  hash=21
TR111: try to clear all
registerPacket  hash=29
registerPacket  hash=17
Restart cwmp server!
cwmpwanport=7547
<cwmp_udpecho_server_loop:82> pset:interface=,srcip=0.0.0.0,port=0>
registerPacket  hash=15
registerPacket  hash=14
$$$$$$$$$$$$$$$$$$$$$$$$$[Enable_all_lan,344]disable lan port!
lanSdsSetLanStatusCommand set configData=0
flashfile_init(3118)>flag[1]! flashp=0xb43e7000 max_size=0x4000
e<cwmpinit_NoDebugMsg>Set No Debug Message[1]
<cwmpinit_DelayStart>Set Delay[30]
<../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gDisplaypassword[1]
<../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gDisplayNotificationPara[0]
<../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gTr143DownloadExpress[1]
<../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gTransferQueue[1]
<../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gConfigTR098[1]
<../../swbase/protocol/cwmp/libcwmp/cwmp_utility.c>Set gWanAppType[1]
flashfile_init(3118)>flag[0]! flashp=0xb43ec000 max_size=0x4000
load default certificate files
flashfile_init>no flashfile
connecting to (80b31a20)
brgForwardInit
handleIGMPandMLD: isIGMPenable:1, isMLDenable:1
Both IGMP and MLD.
Both IGMP and MLD snooping are enabled!
*******ipv6Init2() Start*******
ipv6_IfInit:ifport=l0, adminStatus=0
Not Global or Unicast IPv6 address
Not Global or Unicast IPv6 address
ipv6_IfInit:ifport=e1, adminStatus=1
Not Global or Unicast IPv6 address
getconfig:ifp=e1
gifConfigSet()!
total=0
dsliteConfigSet()!
g_prefix_filter=0
*******ipv6Init2() End********
nabcommand string: clear counter 
"clear" command: No change mode
command string: help 
"help" command: No change mode
command string: show command 
"show" command: No change mode
command string: show web 
"show" command: No change mode
command string: capture 
"capture" command: No change mode
command string: dump 
"dump" command: No change mode
le loopback detecwmp_webserver_init() successful: master socket = 1
cwmp_server(432):cwmp is disable
ct telnetLoginCliType 0 
telnetLoginCliDiag diagshell 

flashfile_init(3118)>flag[1]! flashp=0xb43e7000 max_size=0x4000
load moduleInitFunc
uModule libtr142 is inited
load moduleInitFunc
uModule libvs_omciapi is inited
load moduleOptInitFunc with Opt=3
uModule bdp_00000080 is inited
load moduleInitFunc
uModule me_00040000 is inited
#### pf_rtl96xx_GetDevCapabilities() 7977 fePortNum=0, gePortNum=2, port0_type=2 port1_type=2
Function:omci_interface_mgmt_init line:303 cmd:echo '2 pon0' > /proc/rtl8686gmac/dev_port_mapping
Function:omci_interface_mgmt_init line:306 cmd:/bin/ifconfig pon0 up
Phy Link=0
#### omci_sw_dl_uboot_env_get() 2508 pReturnStr=
#### omci_sw_dl_uboot_env_get() 2508 pReturnStr=0
#### omci_sw_dl_uboot_env_get() 2508 pReturnStr=0
#### omci_sw_dl_uboot_env_get() 2508 pReturnStr=V1.1.3
#### omci_sw_dl_uboot_env_get() 2508 pReturnStr=1
#### omci_sw_dl_uboot_env_get() 2508 pReturnStr=V1.1.3
#### omci_sw_dl_uboot_env_get() 2508 pReturnStr=
< omci_setup_mgmt_interface 9451 > : vlanPara 65535 
[libtr142] omci_cfg_set is called
omci_PonResetOnuType.1551
flashfile_init(3118)>flag[1]! flashp=0xb43e7000 max_size=0x4000
link up for port 0
link down for port 0
omci_wrapper_msgHandler: devMode 0,receiveState 1,usrLogLvl 0, drvLogLvl 0,sn GPON
[libtr142] tid 131073 starts, op = 1
[libtr142] [libtr142] omci_op_set_if is called.
[libtr142] if_is_ip_stack_B = 1
[libtr142] if_tci = 65535
[libtr142] tid 131073 unlock
flash logo config addr:0xb43cb000 size:98304
realtronLogoTable 813 rm inside logo!
realtronLogoTable 844 logo is empty!
realtronLoginLogoTable 903 rm login logo!
flash login logo config addr:0xb43b6000 size:20480
realtronLoginLogoTable 922 login logo is empty!
command string: disable 
"disable" command: No change mode
command string: show mib 
"show" command: No change mode

Username: rtl8226b: VERID = 0x6720 (MDIO set 0 , PHY Addr 7)
lanSdsSetLanStatusCommand set configData=0
Lansds_Rtk_Mac0_Phy_8221b_Detect-1117
get lan global ipv6 address error!
rtk_pon_led_SpecType_set 0
omci_PonResetVsMib.1022
omci_PonResetVsOntCode.166
omci_PonResetVsFirewallLevel.719
omci_PonResetVsLogin.734
omci_PonResetVsAccessControl.757
omci_LanBindModeReset.795
omci_PonResetDhcpOption82Data.525
omci_PonResetDhcpCircuitId.538
omci_PonResetDhcpRemoteId.551
priority: 1, portmask 127, rx: 8031c425
insert here, priority: 4, portmask 4, rx: 80143cd1
europacli get flash check_1453diag "debug gpio set pin 13 state enablecommand:debug gpio set pin 13 state enable
set gpio 13 to enable!
RTK.0> OMCI_Init 640!!!!!!!!!!!!!!!!
up:chno=-1
port 1 is up
rtl8226b: Timeout (dev=1f addr=0xa420 mask=0x03 timeout=0)

get lan global ipv6 address error!
RG_reset_static_route-1818 DONE !
RG_del_PPPoE_Acl 2723: do system (echo 0 > /proc/rg/pppoe_bc_passthrought_to_bindingWan)
RG Limit IPv6 MC!
ethWanConfigInit:3129 pEntry=0x0
ethWanConfigInit:3129 pEntry=0x0
ethWanConfigInit:3129 pEntry=0x0
ethWanConfigInit:3129 pEntry=0x0
ethWanConfigInit:3129 pEntry=0x0
ethWanConfigInit:3129 pEntry=0x0
ethWanConfigInit:3129 pEntry=0x0
ethWanConfigInit:3129 pEntry=0x0
handleIGMPandMLD: isIGMPenable:1, isMLDenable:1
Both IGMP and MLD.
Both IGMP and MLD snooping are enabled!
dmz rule total 0 !
#######ipCircCreate type=1 if_id=1 rcid=0
ipCircSetIPA id_pyhport=1 c->rc_id=1 phyport=1
xipCreateVif...................
ipCircEnable  1194...............
####add 0xc0a80101/0xffffffff in route table 0x80dd3864! owner=5, cid=1 src=0xc0a80101
set network direct route, phyport=1 itf e1.
####add 0xc0a80100/0xffffff00 in route table 0x80dd3864! owner=6, cid=1 src=0xc0a80101
ipCircEnable  1194...............
[webmain:876] Change Hybrid Mode to SFU
rtl8226b: Timeout (dev=1f addr=0xa420 mask=0x03 timeout=0)


cmd=omcicli set devmode bridge

cmd=omcicli mib reset
priority: 1, portmask 127, rx: 8031c425
insert here, priority: 4, portmask 4, rx: 80143cd1

cmd=rg echo 0 stag_enable
to disable stag_enable

cmd=config service dhcp 0
TR111: try to clear all
config ip6 ra stopD[libtr142] omci_cfg_set is called
Phy Link=0
#### omci_sw_dl_uboot_env_get() 2508 pReturnStr=
#### omci_sw_dl_uboot_env_get() 2508 pReturnStr=0
#### omci_sw_dl_uboot_env_get() 2508 pReturnStr=0
#### omci_sw_dl_uboot_env_get() 2508 pReturnStr=V1.1.3
#### omci_sw_dl_uboot_env_get() 2508 pReturnStr=1
#### omci_sw_dl_uboot_env_get() 2508 pReturnStr=V1.1.3
#### omci_sw_dl_uboot_env_get() 2508 pReturnStr=
< omci_setup_mgmt_interface 9451 > : vlanPara 65535 
[libtr142] omci_cfg_set is called
omci_PonResetOnuType.1551
flashfile_init(3118)>flag[1]! flashp=0xb43e7000 max_size=0x4000
[libtr142] tid 262146 starts, op = 1
[libtr142] [libtr142] omci_op_set_if is called.
[libtr142] if_is_ip_stack_B = 1
[libtr142] if_tci = 65535
[libtr142] tid 262146 unlock
[libtr142] tid 327683 starts, op = 1
[libtr142] [libtr142] omci_op_set_if is called.
[libtr142] if_is_ip_stack_B = 1
[libtr142] if_tci = 65535
[libtr142] tid 327683 unlock
isable Router Advertisement Success!
config ip6 dhcpv6 server stop[setLookupMissFloodPmask@748] SW_LAN_PORT_NUM 2
[setLookupMissFloodPmask@758] phyPort 1
[setLookupMissFloodPmask@758] phyPort 0
rg echo 1 igmp_general_query_fromPon_direct_txReset RG QoS total bandwidth to unlimit.
omci_PonResetVsMib.1022
omci_PonResetVsOntCode.166
omci_PonResetVsFirewallLevel.719
omci_PonResetVsLogin.734
omci_PonResetVsAccessControl.757
omci_LanBindModeReset.795
omci_PonResetDhcpOption82Data.525
omci_PonResetDhcpCircuitId.538
omci_PonResetDhcpRemoteId.551
rg echo 0 stag_enableto disable stag_enable
diag "svlan set service-port nonecommand:svlan set service-port none
RTK.0> NULL exist for MIB_TABLE_MAP8021PSERVPROF_INDEX Entry,so up lan!
LAN SDS mode = 0x5
$$$$$$$$$$$$$$$$$$$$$$$$$enable lan port!
lanSdsSetLanStatusCommand set configData=1
--------******start ending ****-----
InformIntevalCnt is set to 300(s)
create memory pool: start at 0x80c3d180, size 15444
Init memory freed, start:80c3d180, len:15444

Estas configurações foram feitas usando o aparelho com o firmware V1.9.4 (custom) para garantir exatidão das informações perante a rede (i.e. HWVER). Não foi testado em versões oficiais/stock. Adicionalmente, na existência de diferenças regionais nos parâmetros da rede, estes passos podem não funcionar em todos os locais.

Atente-se para a OLT que atenda sua região. Conforme a marca, ela pode verificar MEs específicos na ONT que não há suporte. Enquanto a V2802RH lista suporte a emulação de alguns MEs proprietários para diversas marcas (ZTE, Huawei, FiberHome, etc), estes podem estar desativados ou incompletos. A configuração abaixo foi feita em um link atendido por uma OLT Alcatel-Lucent / Nokia (ALCL). Sabe-se que com OLTs Huawei (talvez apenas as “bloqueadas”), normalmente a V-Sol não deve funcionar sem modificações adicionais/firmwares custom.

Dados de acesso padrão da GUI :

• IP: 192.168.1.1
• Usuário: admin
• Password: stdONUi0i

Com o aparelho sem configurações anteriores, desconectado da fibra e de posse do serial GPON de sua ONT previamente autorizada (formato ABCD00112233, ex: HWTC01FFAABB, ALCL02AABBCC, etc), acesse a GUI WEB e faça os passos abaixo. Onde não especificado, preencha com os dados e confirme no botão correspondente. Dados não mencionados aqui podem ser ignorados.

1. Ative o daemon de telnet:

• Advanced > Others > Telnet
  • Enable: selecionado
• Firewall > ACL > ACL
  • Services allowed: desmarque Any e marque apenas telnet. Digite 0.0.0.0 na primeira caixa do intervalo de IP
  • <Add>

2. Configure os parâmetros abaixo. Você pode tentar emulando aparelhos Huawei ou Nokia, conforme sua região:

• Setup > GPON Settings
  • OMCI OLT Mode: Huawei OLT Mode

• Setup > OMCI Information
  • OMCI Vendor ID: HWTC
  • OMCI software version 1: V3R019C10S385
  • OMCI software version 2: V3R019C10S385
  • Traffic Managament option: 2
  • OMCC version: 0x80
  • CWMP Product Class: HG8245Q2
  • HW version: B99.A

• Setup > GPON Settings
  • OMCI OLT Mode: Customized OLT Mode

• Setup > OMCI Information
  • OMCI Vendor ID: ALCL
  • OMCI software version 1: 3FE49025JJII03
  • OMCI software version 2: 3FE49025JJII03
  • Traffic Managament option: 2
  • OMCC version: 0x80
  • CWMP Product Class: G-2425G-A
  • HW version: 3FE48299BFAA

3. Crie o perfil WAN (bridged ou routed funcionam, no entanto os passos abaixo são para bridging com uma interface LAN). O perfil abaixo é apenas para a VLAN de dados da conexão:

• Setup > WAN > WAN
  • Channel mode: Bridge
  • VLAN: Enable
  • VLAN ID(1-4095): 210 (*)
  • VLAN Cos(0-7): 0
  • LAN: Marque LAN2 (* *)
  • <Add>

(*) em alguns locais - devido à limitações no software da V2802RH - pode ser necessário o uso de outras VLANs. A tabela de VLANs e filtros fornecidos pelo OMCI pode ser obtida executando os seguintes comandos via telnet ou serial, após a conexão com a fibra:

omcicli mib get 84
omcicli mib get 171

(* *) LAN1 é a porta 1 Gbit/s e a LAN2 a de 2,5 Gbit/s. Marque ambas, se preferir.

4. Conecte via telnet no aparelho e execute após o login (mesmos dados e credenciais da interface Web):

• cfgmib set OMCI_TM_OPT 2
• flash set GPON_SN XXXXXXXXXXXX
• restart

Substitua o XXXXXXXXXXXX acima pelo serial GPON de sua ONT autorizada. A configuração do parâmetro OMCI_TM_OPT novamente é necessária para corrigir o valor errado que a V2802RH insere ao salvar pela web no passo 2.

5. Após o reboot da V2802RH, conecte a fibra. Atente-se para os conectores SC/UPC / SC/APC e faça a conversão/adequação quando necessário.

6. Conecte seu roteador/cliente DHCP na porta LAN escolhida acima na criação do perfil WAN e obtenha o lease (IPv4 / IPv6).

Bugs conhecidos ou dicas de uso do aparelho.

• No campo “OMCI OLT Mode”, use outros modos que não seja o “Default” para habilitar mais campos na aba “OMCI Information” (e não permitir que o aparelho sobrescreva as versões de software, por exemplo).
• O campo “Traffic Managament option” (sic) será gravado de forma errada na memória ao submeter quaisquer modificações na aba correspondente pela web. Conecte via telnet/serial e defina o valor correto se acontecer. Exemplo:

cfgmib set OMCI_TM_OPT 2
cfgmib save

• Para remover o captcha na tela de login, execute via telnet ou serial:

flash set VALIDATE_CODE_SWITCH 0

• Pode ser necessário desativar o servidor DHCP na LAN da V2802RH e deixar seu roteador/PC configurados com IPs estáticos para acesso à gerência; assim evitando uma espécie de race condition quando o roteador/PC tenta obter o lease via DHCP/IPoE do ISP, pegando um IP interno no lugar.
• Ao alterar o endereço MAC principal da V2802RH (ELAN_MAC_ADDR), ela não valida corretamente o tipo de endereço antes de persisti-lo. Caso um endereço multicast seja definido (detalhes), ela passará a recusar os pacotes pois não são endereçadas exatamente para ela, impedindo totalmente qualquer acesso via rede. Um factory reset não resolverá pois este parâmetro permanece mesmo após a redefinição, sendo necessário conexão via UART/serial no aparelho para definir outro MAC (o original da etiqueta, por exemplo).

Versões oficiais e não modificadas para o aparelho. São de propriedade da V-SOL - que detém todos os direitos sobre elas - e mantidas aqui apenas em caráter de arquivamento e espelhamento, podendo ser removidas caso solicitado pelos representantes da empresa citada.

Não é uma lista exaustiva, apenas alterações que foram vistas durante o processo de rebase pelo O3 Labs.

1. Suporte a HW_VER com 14 caracteres, respeitando a especificação G984.4.
2. Ativado suporte a MEs proprietários da Huawei.
3. Alterações/diff nos parâmetros configuráveis no dispositivo (ID, nome, tamanho máximo do parâmetro em hexadecimal):

...
 0x9e10, OMCI_SW_VER2, 0x20
 0x9e11, OMCI_FAKE_OK, 0x4
 0x9e12, OMCI_OLT_MODE, 0x1
-0xc012, HW_HWVER, 0x5
+0x9e13, OMCI_OLT2_MODE, 0x1
+0xc012, HW_HWVER, 0xf
 0xc013, PON_VENDOR_ID, 0x5
 0xc014, PORT_REMAPPING, 0x8
 0x9e51, LOID, 0x19
...
 0xc02f, NXP_PONMAC, 0x6
 0xa0a0, TK_QUEUE_CFG, 0x40
 0xc030, HW_IPHOST_WAN_DISABLE, 0x1
+0xc031, WEB_MENU_TYPE_CONTROL, 0x1
+0xa0a2, WEB_FIREWALL, 0x1
+0xa0a3, FILTER_PORTPHY, 0x1
+0xa0a4, FILTER_VLANPRI, 0x1
+0xa0a5, LAN_NUM, 0x1
+0xc032, FORCE_SINGLE_LLID, 0x1
+0xa0a6, FAIL_EPON_RESET, 0x1
+0xc034, HW_CWMP_MANUFACTURER, 0x80
+0xa0a7, SUPPORT_BODA_IPHOST, 0x1
+0xa0a8, FILTER_POE, 0x1

V2802RH_V1.1.8_240507_S893.img (Build date: 07/05/2024 | SHA256: aeb1c563930848d00d300dd25335e9616ec89578d4aeda03451460d25ceb712b)

V2802RH_V1.1.7_230911_S693.img (Build date: 11/09/2023 | SHA256: fccaf44cf32b6aef03cfd39b5081a384a3b9886640dd494dc42a248190d13cfb)

Versões modificadas com correções e/ou melhorias, baseadas em releases oficiais.

Dentro das versões custom normais (não “especiais”), estas são cumulativas, ou seja, a mais recente sempre contém todas as modificações das versões anteriores.

É possível atualizar entre versões custom ou stock sem nenhum problema. Note que saltos na versão base podem incluir ou remover parâmetros de configuração, portanto é aconselhável um factory reset após realizar tais atualizações. Adicionalmente, efetue estes procedimentos com a fibra desconectada do aparelho.

Caso a versão base (ex.: 1.1.7) continue a mesma de uma versão custom para a outra, não é necessário o factory reset, salvo se solicitado explicitamente na descrição.

Ordem decrescente, mais recentes primeiro.

• Altera as configurações de controle de fluxo da porta 2,5 GE ao iniciar (informações fornecidas pela comunidade, não testado no lab). Supostamente corrige quedas na velocidade de upload em algumas ocasiões.
  • Era uma modificação “especial” mas que foi incorporada nas versões custom normais.

V2802RH_V1.A.2.img (Build date: 06/06/2024 | SHA256: 793582d409540c718d5048c71dc9af910cec49421ec9ab234ae041f505e60cb4)

• Rebase no release oficial V1.1.8 (S893)
• Removido patch para HW_VER de até 14 caracteres (foi implementando oficialmente na versão base).
• Removido patch para suporte a MEs proprietários da Huawei (foi implementando oficialmente na versão base).
• Patch para remover a validação do VS_KEY com o MAC address.
• Aconselhável factory reset após atualizar para esta versão.

V2802RH_V1.A.1.img (Build date: 06/06/2024 | SHA256: 8bca0d5d7c5efaa49414d3e1ed82e7d706fc7b689a193fcceee37ac99b1b9b0d)

• Habilita MIBs/MEs proprietários da Huawei. Útil para regiões com OLTs Huawei que exigem estas extensões. Certifique-se de emular um aparelho Huawei neste caso. Não impacta caso a OLT que atenda seu link não seja desta marca.

V2802RH_V1.9.4.img (Build date: 19/09/2023 | SHA256: d2d6b94ed1fc237e2dc9d7bc78069c4d5bd56e8fc708d0eb01c35cf27761e30a)

• Alterado tamanho máximo do campo HW_HWVER/HW version para 14 caracteres para sincronia com a interface web e é o máximo permitido pelo G.984.4 de qualquer forma.
• Baseada no release oficial V1.1.7

V2802RH_V1.9.3.img (Build date: 19/09/2023 | SHA256: 22b4926602167c8d44fd5edf82765e7410ef6af6395498c62449f554ce8fba46)

• Alterado tamanho máximo do campo HW_HWVER/HW version para 18 caracteres (via telnet ou serial; pela GUI Web o máximo são 14 caracteres).

V2802RH_V1.9.2.img (Build date: 03/09/2023 | SHA256: 8a1c432223a6237616d10aea9926b028a34c240ed6fffc4cc9e59e8b401a6111)

• Removido validação do MAC pela chave de autorização. Qualquer MAC (ELAN_MAC_ADDR) pode ser utilizado agora.
• Baseada no release oficial V1.1.6

V2802RH_V1.9.1.img (Build date: 01/09/2023 | SHA256: f0f56fcc7be1643a45cd3be59e65b276321a3a5c69f9d14619256050834974b5)

Estas versões são consideradas “especiais” pois foram construídas para atender casos específicos ou devido a solicitação de usuários. Portanto, caso a modificação listada não se aplique a seu caso, não utilize-as e opte pelas versões custom normais ou oficiais.

• Baseada no release custom V1.A.?

Em desenvolvimento

• Aplica o seguinte comando sempre ao iniciar:
  • omcicli mib set 84 0xe103 FwdOp 0x15
• Supostamente altera a operação de encaminhamento da VLAN de dados em algumas regiões com OLT Alcatel-Lucent/Nokia da Oi/V.tal. Não testado no lab, apenas pela comunidade.
• Baseada no release custom V1.9.4

V2802RH_V1.9.W.img (Build date: 17/10/2023 | SHA256: fe168b7d017193b73ba6c3640c2875098a278a5ba05ad717ea8bfdfbdd67a44d)

• Aplica os seguintes comandos sempre ao iniciar:
  • omcicli mib set 84 0xe102 FwdOp 0x02
  • omcicli mib set 84 0xe103 FwdOp 0x15
  • omcicli mib set 84 0xe10b FwdOp 0x02
• Supostamente altera as operações de encaminhamento das VLANs para uso da VLAN de dados em algumas regiões com OLT Alcatel-Lucent/Nokia da Oi/V.tal. Não testado no lab, apenas pela comunidade.
• Baseada no release custom V1.9.4

V2802RH_V1.9.V.img (Build date: 14/10/2023 | SHA256: b66afed567a03e8f2d42a32a4a9f9f02bd6c8c2d7088242ade4272f71c527315)

• Aplica o seguinte comando sempre ao iniciar:
  • diag “port set auto-nego port 0 ability 2500f asy-flow-control”
• Supostamente corrige baixas velocidades de upload ao utilizar a porta LAN de 2,5 Gbit/s para destinos na interface PON com maiores latências. Não testado no lab, apenas pela comunidade.
• Baseada no release custom V1.9.4

V2802RH_V1.9.G.img (Build date: 11/10/2023 | SHA256: 7edab7be609942d1d0546e6fe52c7a10c40da878951533657dc020c92d3316d3)

Pessoas envolvidas em arquivos, discussões, dicas ou bate papo em geral. Lista em ordem alfabética.

chundz, FelipeSS, Japa182, T1AGO